A system for controlling a motor vehicle is known from German No. DE-OS-35 31 198. The system, which is for controlling a diesel engine, comprises a main processor and a substitute processor. If a monitoring device recognizes a defect in the main processor, the system switches over to the substitute processor.
Furthermore, systems are known in which a first microprocessor determines control data which are required for control of the motor vehicle. A monitoring device checks whether the first microprocessor is functioning correctly. This monitoring device can be structured as a microprocessor or, in the simplest form, as a hard-wired module. If the monitoring device recognizes an operating state which is critical to safety, the output value relevant to safety goes into a safe state via a corresponding safety signal. This means, for example, that the fuel injection is stopped and/or the throttle valve is closed.
Such a monitoring device is known, for example, from German No. DE-OS-32 40 707. The monitoring device described therein applies a so-called trigger signal to the control device at regular intervals. If the distance between two trigger impulses is greater or less than a time period stored in the monitoring device, the monitoring device detects an error and initiates corresponding measures. With such a monitoring concept, it is essentially only total failure of the processor that can be recognized. Such a watchdog circuit does not recognize defective signal processing.